#!/usr/bin/env bash
set -uo pipefail
source '{{ healthcheck_install_root }}/health-common.sh'

require_command docker
require_command curl
require_command openssl
require_command dig
require_command timeout
check_compose

watchdog="$(docker compose --project-directory '{{ compose_project_dir }}' logs --tail=40 watchdog-mailcow 2>&1)" || record critical 'watchdog_log_failed'
grep -qiE '100%|healthy' <<<"$watchdog" || record warning 'watchdog_health_not_confirmed'

queue="$(docker compose --project-directory '{{ compose_project_dir }}' exec -T postfix-mailcow postqueue -p 2>&1)" || record critical 'mail_queue_check_failed'
grep -Fqi 'Mail queue is empty' <<<"$queue" || record warning 'mail_queue_nonempty'

listeners="$(ss -lnt 2>/dev/null)"
for port in 25 465 587 993 443; do
  grep -qE ":${port}[[:space:]]" <<<"$listeners" || record critical "listener_missing_${port}"
done

check_https 'https://mx2.windy.me/' '^200$'
check_tls_days mx2.windy.me 443
smtp="$(timeout 10 bash -c "exec 3<>/dev/tcp/mx2.windy.me/25; printf 'EHLO health.local\\r\\nQUIT\\r\\n' >&3; cat <&3" 2>/dev/null)" || record critical 'smtp_connect_failed'
grep -qiE 'Postcow|ESMTP' <<<"$smtp" || record critical 'smtp_banner_unexpected'

for resolver in 1.1.1.1 8.8.8.8; do
  mx="$(dig +short +time=3 +tries=1 "@${resolver}" windy.me MX 2>/dev/null)"
  grep -Fqi 'mx2.windy.me' <<<"$mx" && { record ok 'mx_record_ok'; break; } || record warning 'mx_record_not_confirmed'
done
spf="$(dig +short +time=3 +tries=1 @1.1.1.1 windy.me TXT 2>/dev/null)"
grep -Fqi 'v=spf1' <<<"$spf" || record warning 'spf_not_confirmed'
check_backup_freshness '*/backup/*'
emit_result
exit "$EXIT_CODE"